Hayabusa high test sigma

Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ParentImage
| endswith": "\\Atlassian\\Confluence\\jre\\bin\\java.exe",
    "CommandLine
| contains": [
      "certutil",
      "cmd /c",
      "cmd /k",
      "cscript",
      "curl",
      "ipconfig",
      "powershell",
      "pwsh",
      "regsvr32",
      "rundll32",
      "whoami",
      "wscript"
    ]
  },
  "condition": "process_creation and selection"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...